01/01: gnu: libzip: Fix CVE-2017-12858.

[Leo Famulari]

lfam pushed a commit to branch master
in repository guix.

commit 9baa969758557857a4c8614278b59db9786ae1eb
Author: Leo Famulari <address@hidden>
Date:   Sun Aug 27 19:39:21 2017 -0400

    gnu: libzip: Fix CVE-2017-12858.
    
    * gnu/packages/patches/libzip-CVE-2017-12858.patch: New file.
    * gnu/local.mk (dist_patch_DATA): Add it.
    * gnu/packages/compression.scm (libzip)[source]: Use it.
---
 gnu/local.mk                                     |  1 +
 gnu/packages/compression.scm                     |  1 +
 gnu/packages/patches/libzip-CVE-2017-12858.patch | 45 ++++++++++++++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/gnu/local.mk b/gnu/local.mk
index b2d85a5..2ff87df 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -807,6 +807,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/libxslt-generated-ids.patch             \
   %D%/packages/patches/libxslt-CVE-2016-4738.patch             \
   %D%/packages/patches/libxt-guix-search-paths.patch           \
+  %D%/packages/patches/libzip-CVE-2017-12858.patch             \
   %D%/packages/patches/lierolibre-check-unaligned-access.patch \
   %D%/packages/patches/lierolibre-is-free-software.patch       \
   %D%/packages/patches/lierolibre-newer-libconfig.patch                \
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 0a97ba7..4e316e0 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -1525,6 +1525,7 @@ manipulate, read, and write Zip archive files.")
               (method url-fetch)
               (uri (string-append
                     "https://nih.at/libzip/libzip-"; version ".tar.gz"))
+              (patches (search-patches "libzip-CVE-2017-12858.patch"))
               (sha256
                (base32
                 "17vxj2ffsxwh8lkc6801ppmwj15jp8q58rin76znxfbx88789ybc"))))
diff --git a/gnu/packages/patches/libzip-CVE-2017-12858.patch 
b/gnu/packages/patches/libzip-CVE-2017-12858.patch
new file mode 100644
index 0000000..8125173
--- /dev/null
+++ b/gnu/packages/patches/libzip-CVE-2017-12858.patch
@@ -0,0 +1,45 @@
+Fix CVE-2017-12858:
+
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12858
+
+Patch copied from upstream source repository:
+
+https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796
+
+From 2217022b7d1142738656d891e00b3d2d9179b796 Mon Sep 17 00:00:00 2001
+From: Thomas Klausner <address@hidden>
+Date: Mon, 14 Aug 2017 10:55:44 +0200
+Subject: [PATCH] Fix double free().
+
+Found by Brian 'geeknik' Carpenter using AFL.
+---
+ THANKS           | 1 +
+ lib/zip_dirent.c | 3 ---
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/THANKS b/THANKS
+index be0cca9..a80ee1d 100644
+--- a/THANKS
++++ b/THANKS
+@@ -12,6 +12,7 @@ BALATON Zoltan <address@hidden>
+ Benjamin Gilbert <address@hidden>
+ Boaz Stolk <address@hidden>
+ Bogdan <address@hidden>
++Brian 'geeknik' Carpenter <address@hidden>
+ Chris Nehren <address@hidden>
+ Coverity <address@hidden>
+ Dane Springmeyer <address@hidden>
+diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c
+index a369900..e5a7cc9 100644
+--- a/lib/zip_dirent.c
++++ b/lib/zip_dirent.c
+@@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, 
zip_buffer_t *buffer, boo
+     }
+ 
+     if (!_zip_dirent_process_winzip_aes(zde, error)) {
+-      if (!from_buffer) {
+-          _zip_buffer_free(buffer);
+-      }
+       return -1;
+     }
+